I am working Computer Forensics on CCTF disk. The disk was given as part of discovery and I believe the dates on the video file are altered. IE the subject set the time on the system to create an alibi. The only other date I have is on a GeoLan.ini file which places the time correctly, can someone explain how this GeoLan.ini file works?
Thanks